Which one should I draft?

: If an IAM Role is attached to the instance, this endpoint lists the name of that role.

: 169.254.169.254 is a link-local address accessible only from within the instance.

Log all outgoing HTTP requests to 169.254.169.254 . Alert when unexpected processes (e.g., a web server UID) make such calls.